alert dns $HOME_NET any -> any any (msg:"ET MALWARE GratefulPOS Covert DNS CnC Initial Checkin"; dns.query; content:".grp"; within:12; content:"ping.adm."; within:15; fast_pattern; isdataat:30,relative; pcre:"/^[a-f0-9]{8}\.grp[0-9]*\.ping\.adm\.(?:[a-f0-9]+\.){2,}/"; reference:md5,67a53bd24ee8499fed79c8c368e05f7a; reference:url,community.rsa.com/community/products/netwitness/blog/2017/12/08/gratefulpos-credit-card-stealing-malware-just-in-time-for-the-shopping-season; classtype:command-and-control; sid:2025144; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_12_11, deployment Perimeter, malware_family Grateful_POS, performance_impact Moderate, confidence High, signature_severity Major, updated_at 2020_11_17;)